Jashn Wahi

Authenticated users can perform stored cross-site scripting by uploading unsanitized SVG files. This occurs when JavaScript-laden SVGs are uploaded via the profile update or settings upload endpoints and subsequently executed in the browsers of victims when accessed through the `/public` route.

An argument injection issue exists in the `git log`, `git diff`, and `git show` tools due to a lack of leading-dash validation in the `ref` and `object` parameters. This allows attackers to inject git command-line options, such as `--output=`, to write files to arbitrary paths accessible by the process outside of the repository.

An issue exists where an attacker who controls the `.vervet.yaml` configuration file can execute arbitrary OS commands. This occurs when malicious input is injected into the `linters.<key>.optic-ci.original` branch name field. The `expectGitBranch()` function in `src/lint.ts` passes the unsanitized branch name directly into `child process.exec()` using an unescaped template literal, allowing command execution when the lint command is run against the repository.

Authenticated attackers can read arbitrary files by providing absolute filesystem paths to the 'GET /public/get-file/{path}' endpoint. This occurs because the `path` route parameter is passed directly to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form to prevent bypassing security checks. This allows the retrieval of sensitive files accessible to the PHP-FPM worker process without requiring directory traversal sequences.

Volmarg Personal Management System allows authenticated attackers to read arbitrary files via the 'GET /public/get-file/{path}' endpoint. The `path` route parameter is passed to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form, allowing the retrieval of sensitive files accessible to the PHP-FPM worker process. DrayTek VigorAP models contain a command injection flaw in the `ExportSettings()` function. Insufficient filtering of the `backupkey`, `backuptype`, and `realtime` fields allows a remote attacker with administrative credentials to execute arbitrary commands with root privileges.

A path traversal issue exists in the `com joomlaupdate` extension. A Super User can be tricked into extracting a specially crafted archive containing absolute paths or directory traversal sequences in ZIP entry filenames. By providing these malicious names to the `extract.php` extraction routine, files can be written outside the intended destination root, which allows for persistent remote code execution through the placement of PHP files.